Android Key Code Location¶
AndroidManifest.xml file
- Package name
- APK main activity; hidden programs do not have a main Activity
Application starts earliest at the Java layer.
Sequential Analysis¶
The most common and useful method is to follow the program's logic and examine the code sequentially for analysis. However, when the program's codebase is particularly large, this method becomes less efficient and requires other methods to assist.
String-Based Location¶
The so-called string-based location method involves locating the corresponding functions through strings that appear during program execution. Strings may be directly hardcoded in the program, or they may be indexed by string IDs. This method used to be quite convenient to use, but nowadays, strings may be split up or first encrypted and then dynamically decrypted during runtime.
Strings we might focus on include:
- Program error messages
- Services
- Broadcasts
Sensitive API Location¶
The so-called sensitive API location method means that we determine which functions the program may have called based on its execution behavior. This method requires us to be quite familiar with the APIs in Android. Generally speaking, we might focus on the following aspects:
- Control event functions
- onclick
- show
- Toast
- Network functions
- HttpGet
- HttpPost
- HttpUriRequest
- socket
- Sending SMS
- Making phone calls
- Location services
- And more
Log Information¶
Log information refers to the string information output by Android programs during runtime. This information is not displayed on our interface, so we need to use other auxiliary tools for analysis. For example, we can use DDMS to assist with analysis. For log information, we can consider two approaches:
- Utilize the log information generated by the program itself.
- Decompile the code yourself, insert log information, and repackage it for analysis.
Stack Tracing¶
We can use the method call chain information provided by DDMS to determine the current call relationships of the program.
Hooking¶
- xposed
- cydia
Monitor¶
- Runtime logs: generated by program execution, generated by system operation
- Thread tracing
- Method call chain